Privacy Policy

1. Introduction

ResearchKar ("we", "us", or "our") operates the website at https://researchkar.com, an Indian stock market research and AI analysis platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights under applicable law — including India's Digital Personal Data Protection Act, 2023 ("DPDPA"), the EU General Data Protection Regulation ("GDPR"), and the California Consumer Privacy Act ("CCPA").

By using ResearchKar you agree to the collection and use of information in accordance with this Policy.

2. Data We Collect and Why

2.1 Account Data

When you create an account or log in, we collect:

• Email address — to identify your account and send transactional emails (e.g. password reset)
• Password — stored as a one-way bcrypt hash; we never store your plain-text password
• First name and last name — to personalise your experience
• Account creation timestamp, last login time, and login count — for security monitoring and fraud prevention
• Google OAuth identity token — if you sign in with Google; we receive your verified email and name from Google and do not store the token itself

Legal basis (GDPR): Contract performance and legitimate interests. Legal basis (DPDPA): Consent given at registration.

2.2 Usage and Technical Data

We automatically collect limited technical data when you use the site:

• IP address (used for security, rate-limiting, and approximate geolocation at city/country level)
• Browser type, version, and device type
• Pages visited, time spent, and referring URL
• API endpoints accessed and response codes (for service reliability monitoring)

2.3 Analytics (Google Analytics 4)

We use Google Analytics 4 ("GA4") to understand how visitors use our site. GA4 uses cookies and collects pseudonymous identifiers. We have enabled IP anonymisation. GA4 data is processed by Google LLC under a Data Processing Agreement. You can opt out at any time using the Google Analytics Opt-out Browser Add-on.

2.4 Advertising (Reddit Ads & Meta Ads)

We use Reddit Ads and Meta (Facebook/Instagram) Ads to reach potential users. Both platforms place pixel tracking scripts on the Platform that may set cookies and collect data such as your IP address, browser information, and pages visited in order to measure ad performance and show relevant ads on their platforms.

• Reddit Ads: You can opt out via Reddit Privacy Settings or the NAI opt-out tool.
• Meta Ads: You can manage your ad preferences at facebook.com/adpreferences or opt out of interest-based advertising via aboutads.info.

2.5 Data We Do Not Collect

• Portfolio, brokerage, or trading account data
• Payment or financial card information
• Precise GPS location
• Biometric data

3. Cookies

We use the following categories of cookies:

• Strictly necessary: auth_token (HttpOnly, Secure) — maintains your login session. Cannot be disabled.
• Analytics: Google Analytics cookies (_ga, _gid) — measure site usage. Opt-out available.
• Advertising: Reddit Pixel (_rdt_uuid) and Meta Pixel (_fbp, _fbc) — measure ad conversion and enable retargeting. Can be disabled via Reddit Privacy Settings or Meta Ad Preferences.

You can manage or delete cookies at any time through your browser settings. Note that disabling strictly-necessary cookies will log you out.

4. How We Use Your Data

• To create and manage your account
• To send password-reset and security notification emails
• To authenticate you on each visit via your session cookie
• To detect and prevent fraud, abuse, and unauthorised access
• To improve site performance and user experience (analytics)
• To measure advertising performance and enable retargeting (Reddit Ads, Meta Ads)
• To comply with legal obligations

We do not use your data to make automated decisions that produce legal or similarly significant effects.

5. Data Sharing and Third Parties

We share data only as described below:

• Google LLC — GA4 analytics and Google OAuth authentication, under signed Data Processing Agreements
• Reddit, Inc. — Reddit Ads pixel for conversion measurement and retargeting (production only)
• Meta Platforms, Inc. — Meta Pixel for conversion measurement and retargeting (production only)
• Hetzner Online GmbH — cloud hosting provider where your data is stored (EU data centres)
• Cloudflare, Inc. — CDN and DDoS protection; processes request metadata at the network edge

We do not sell, rent, or trade your personal data with advertisers, data brokers, or marketing agencies.

6. Data Retention

• Account data: Retained for as long as your account is active. Deleted within 30 days of a verified account-deletion request.
• Server logs: Retained for up to 90 days for security purposes, then deleted.
• GA4 data: Retained for 14 months (Google's default), then automatically deleted.

7. Data Security

We implement the following security measures:

• Passwords hashed using bcrypt (cost factor 10+)
• Session tokens transmitted only over HTTPS via HttpOnly, Secure cookies
• Database access restricted to application servers via private network
• Regular dependency updates and security patching

No method of transmission over the internet is 100% secure. If we become aware of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by law.

8. Your Rights

8.1 Rights Under DPDPA 2023 (India)

• Right to access — obtain a summary of personal data we hold about you
• Right to correction — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data
• Right to grievance redressal — raise a complaint with our Data Protection Officer
• Right to nominate — nominate another person to exercise rights on your behalf in the event of your death or incapacity

8.2 Rights Under GDPR (EU/EEA Users)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to lodge a complaint with your local supervisory authority

8.3 Rights Under CCPA (California Residents)

• Right to know what personal information we collect and how it is used
• Right to delete personal information
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise any of the above rights, email us at support@researchkar.com. We will respond within 30 days (or as required by applicable law).

9. Children's Privacy

ResearchKar is not directed at children under 18 years of age (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

10. International Data Transfers

Your data may be processed in countries other than your own (including Germany, where our servers are located, and the United States, where Google operates). Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms to protect your data when it crosses borders.

11. Links to Third-Party Sites

Our platform may link to external websites (e.g. news sources, stock exchange portals). We are not responsible for their privacy practices and encourage you to review their policies independently.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by updating the "Last Updated" date above. Where required by law, we will notify you by email or in-app notice before the changes take effect.

13. Contact and Grievance Officer

For privacy questions, data requests, or grievances (including under DPDPA 2023):

Email: support@researchkar.com
Website: https://researchkar.com/contact

We aim to acknowledge all privacy requests within 72 hours and resolve them within 30 days.